2 protocol.c -- handle the meta-protocol
3 Copyright (C) 1999,2000 Ivo Timmermans <itimmermans@bigfoot.com>,
4 2000 Guus Sliepen <guus@sliepen.warande.net>
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 2 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program; if not, write to the Free Software
18 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
20 $Id: protocol.c,v 1.28.4.54 2000/11/03 22:35:11 zarq Exp $
25 #include <sys/types.h>
30 #include <sys/socket.h>
37 #include <netinet/in.h>
39 #include <openssl/sha.h>
40 #include <openssl/rand.h>
41 #include <openssl/evp.h>
52 int check_id(char *id)
56 for (i = 0; i < strlen(id); i++)
57 if(!isalnum(id[i]) && id[i] != '_')
63 /* Generic request routines - takes care of logging and error detection as well */
65 int send_request(conn_list_t *cl, const char *format, ...)
68 char buffer[MAXBUFSIZE];
72 /* Use vsnprintf instead of vasprintf: faster, no memory fragmentation, cleanup is automatic,
73 and there is a limit on the input buffer anyway */
75 va_start(args, format);
76 len = vsnprintf(buffer, MAXBUFSIZE, format, args);
77 request = va_arg(args, int);
80 if(len < 0 || len > MAXBUFSIZE-1)
82 syslog(LOG_ERR, _("Output buffer overflow while sending %s to %s (%s)"), request_name[request], cl->name, cl->hostname);
88 if(debug_lvl >= DEBUG_PROTOCOL)
89 syslog(LOG_DEBUG, _("Sending %s to %s (%s)"), request_name[request], cl->name, cl->hostname);
92 return send_meta(cl, buffer, len);
95 int receive_request(conn_list_t *cl)
99 if(sscanf(cl->buffer, "%d", &request) == 1)
101 if((request < 0) || (request > 255) || (request_handlers[request] == NULL))
103 syslog(LOG_ERR, _("Unknown request from %s (%s)"),
104 cl->name, cl->hostname);
109 if(debug_lvl >= DEBUG_PROTOCOL)
110 syslog(LOG_DEBUG, _("Got %s from %s (%s)"),
111 request_name[request], cl->name, cl->hostname);
114 if((cl->allow_request != ALL) && (cl->allow_request != request))
116 syslog(LOG_ERR, _("Unauthorized request from %s (%s)"), cl->name, cl->hostname);
120 if(request_handlers[request](cl))
121 /* Something went wrong. Probably scriptkiddies. Terminate. */
123 syslog(LOG_ERR, _("Error while processing %s from %s (%s)"),
124 request_name[request], cl->name, cl->hostname);
130 syslog(LOG_ERR, _("Bogus data received from %s (%s)"),
131 cl->name, cl->hostname);
138 /* Connection protocol:
147 ---------------------------------------
150 ---------------------------------------
153 ---------------------------------------
159 (E) Encrypted with symmetric cipher.
161 Part of the challenge is directly used to set the symmetric cipher key and the initial vector.
162 Since a man-in-the-middle cannot decrypt the RSA challenges, this means that he cannot get or
163 forge the key for the symmetric cipher.
166 int send_id(conn_list_t *cl)
169 cl->allow_request = CHALLENGE;
171 return send_request(cl, "%d %s %d %lx %hd", ID, myself->name, myself->protocol_version, myself->options, myself->port);
174 int id_h(conn_list_t *cl)
179 if(sscanf(cl->buffer, "%*d %as %d %lx %hd", &cl->name, &cl->protocol_version, &cl->options, &cl->port) != 4)
181 syslog(LOG_ERR, _("Got bad ID from %s"), cl->hostname);
185 /* Check if version matches */
187 if(cl->protocol_version != myself->protocol_version)
189 syslog(LOG_ERR, _("Peer %s (%s) uses incompatible version %d"),
190 cl->name, cl->hostname, cl->protocol_version);
194 /* Check if identity is a valid name */
196 if(check_id(cl->name))
198 syslog(LOG_ERR, _("Peer %s uses invalid identity name"), cl->hostname);
202 /* Load information about peer */
204 if(read_host_config(cl))
206 syslog(LOG_ERR, _("Peer %s had unknown identity (%s)"), cl->hostname, cl->name);
210 /* First check if the host we connected to is already in our
211 connection list. If so, we are probably making a loop, which
215 if(cl->status.outgoing)
217 if((old = lookup_id(cl->name)))
219 if(debug_lvl >= DEBUG_CONNECTIONS)
220 syslog(LOG_NOTICE, _("Uplink %s (%s) is already in our connection list"), cl->name, cl->hostname);
221 cl->status.outgoing = 0;
222 old->status.outgoing = 1;
223 terminate_connection(cl);
228 if((cfg = get_config_val(cl->config, publickey)))
230 cl->rsa_key = RSA_new();
231 BN_hex2bn(&cl->rsa_key->n, cfg->data.ptr);
232 BN_hex2bn(&cl->rsa_key->e, "FFFF");
236 syslog(LOG_ERR, _("No public key known for %s (%s)"), cl->name, cl->hostname);
240 return send_challenge(cl);
243 int send_challenge(conn_list_t *cl)
248 len = RSA_size(cl->rsa_key);
250 /* Allocate buffers for the challenge */
252 buffer = xmalloc(len*2+1);
255 free(cl->hischallenge);
257 cl->hischallenge = xmalloc(len);
259 /* Copy random data to the buffer */
261 RAND_bytes(cl->hischallenge, len);
263 cl->hischallenge[0] &= 0x7F; /* Somehow if the first byte is more than 0xD0 or something like that, decryption fails... */
265 if(debug_lvl >= DEBUG_SCARY_THINGS)
267 bin2hex(cl->hischallenge, buffer, len);
268 buffer[len*2] = '\0';
269 syslog(LOG_DEBUG, _("Generated random challenge (unencrypted): %s"), buffer);
272 /* Encrypt the random data */
274 if(RSA_public_encrypt(len, cl->hischallenge, buffer, cl->rsa_key, RSA_NO_PADDING) != len) /* NO_PADDING because the message size equals the RSA key size and it is totally random */
276 syslog(LOG_ERR, _("Error during encryption of challenge for %s (%s)"), cl->name, cl->hostname);
281 /* Convert the encrypted random data to a hexadecimal formatted string */
283 bin2hex(buffer, buffer, len);
284 buffer[len*2] = '\0';
286 /* Send the challenge */
288 cl->allow_request = CHAL_REPLY;
289 x = send_request(cl, "%d %s", CHALLENGE, buffer);
295 int challenge_h(conn_list_t *cl)
300 if(sscanf(cl->buffer, "%*d %as", &buffer) != 1)
302 syslog(LOG_ERR, _("Got bad CHALLENGE from %s (%s)"), cl->name, cl->hostname);
306 len = RSA_size(myself->rsa_key);
308 /* Check if the length of the challenge is all right */
310 if(strlen(buffer) != len*2)
312 syslog(LOG_ERR, _("Intruder: wrong challenge length from %s (%s)"), cl->name, cl->hostname);
317 /* Allocate buffers for the challenge */
320 cl->mychallenge = xmalloc(len);
322 /* Convert the challenge from hexadecimal back to binary */
324 hex2bin(buffer,buffer,len);
326 /* Decrypt the challenge */
328 if(RSA_private_decrypt(len, buffer, cl->mychallenge, myself->rsa_key, RSA_NO_PADDING) != len) /* See challenge() */
330 syslog(LOG_ERR, _("Error during encryption of challenge for %s (%s)"), cl->name, cl->hostname);
335 if(debug_lvl >= DEBUG_SCARY_THINGS)
337 bin2hex(cl->mychallenge, buffer, len);
338 buffer[len*2] = '\0';
339 syslog(LOG_DEBUG, _("Received random challenge (unencrypted): %s"), buffer);
344 /* Rest is done by send_chal_reply() */
346 return send_chal_reply(cl);
349 int send_chal_reply(conn_list_t *cl)
351 char hash[SHA_DIGEST_LENGTH*2+1];
355 syslog(LOG_ERR, _("Trying to send CHAL_REPLY to %s (%s) without a valid CHALLENGE"), cl->name, cl->hostname);
359 /* Calculate the hash from the challenge we received */
361 SHA1(cl->mychallenge, RSA_size(myself->rsa_key), hash);
363 /* Convert the hash to a hexadecimal formatted string */
365 bin2hex(hash,hash,SHA_DIGEST_LENGTH);
366 hash[SHA_DIGEST_LENGTH*2] = '\0';
370 if(cl->status.outgoing)
371 cl->allow_request = ID;
373 cl->allow_request = METAKEY;
376 return send_request(cl, "%d %s", CHAL_REPLY, hash);
379 int chal_reply_h(conn_list_t *cl)
382 char myhash[SHA_DIGEST_LENGTH];
384 if(sscanf(cl->buffer, "%*d %as", &hishash) != 1)
386 syslog(LOG_ERR, _("Got bad CHAL_REPLY from %s (%s)"), cl->name, cl->hostname);
391 /* Check if the length of the hash is all right */
393 if(strlen(hishash) != SHA_DIGEST_LENGTH*2)
395 syslog(LOG_ERR, _("Intruder: wrong challenge reply length from %s (%s)"), cl->name, cl->hostname);
400 /* Convert the hash to binary format */
402 hex2bin(hishash, hishash, SHA_DIGEST_LENGTH);
404 /* Calculate the hash from the challenge we sent */
406 SHA1(cl->hischallenge, RSA_size(cl->rsa_key), myhash);
408 /* Verify the incoming hash with the calculated hash */
410 if(memcmp(hishash, myhash, SHA_DIGEST_LENGTH))
412 syslog(LOG_ERR, _("Intruder: wrong challenge reply from %s (%s)"), cl->name, cl->hostname);
413 if(debug_lvl >= DEBUG_SCARY_THINGS)
415 bin2hex(myhash, hishash, SHA_DIGEST_LENGTH);
416 hishash[SHA_DIGEST_LENGTH*2] = '\0';
417 syslog(LOG_DEBUG, _("Expected challenge reply: %s"), hishash);
426 /* Identity has now been positively verified.
427 If we are accepting this new connection, then send our identity,
428 if we are making this connecting, acknowledge.
431 if(cl->status.outgoing)
432 return send_metakey(cl);
437 int send_metakey(conn_list_t *cl)
442 len = RSA_size(cl->rsa_key);
444 /* Allocate buffers for the meta key */
446 buffer = xmalloc(len*2+1);
448 if(!cl->cipher_outkey)
449 cl->cipher_outkey = xmalloc(len);
451 if(!cl->cipher_outctx)
452 cl->cipher_outctx = xmalloc(sizeof(*cl->cipher_outctx));
454 /* Copy random data to the buffer */
456 RAND_bytes(cl->cipher_outkey, len);
458 cl->cipher_outkey[0] &= 0x7F; /* FIXME: Somehow if the first byte is more than 0xD0 or something like that, decryption fails... */
460 if(debug_lvl >= DEBUG_SCARY_THINGS)
462 bin2hex(cl->cipher_outkey, buffer, len);
463 buffer[len*2] = '\0';
464 syslog(LOG_DEBUG, _("Generated random meta key (unencrypted): %s"), buffer);
467 /* Encrypt the random data */
469 if(RSA_public_encrypt(len, cl->cipher_outkey, buffer, cl->rsa_key, RSA_NO_PADDING) != len) /* NO_PADDING because the message size equals the RSA key size and it is totally random */
471 syslog(LOG_ERR, _("Error during encryption of meta key for %s (%s)"), cl->name, cl->hostname);
476 /* Convert the encrypted random data to a hexadecimal formatted string */
478 bin2hex(buffer, buffer, len);
479 buffer[len*2] = '\0';
481 /* Send the meta key */
483 if(cl->status.outgoing)
484 cl->allow_request = METAKEY;
486 cl->allow_request = ACK;
488 x = send_request(cl, "%d %s", METAKEY, buffer);
491 EVP_EncryptInit(cl->cipher_outctx, EVP_bf_cfb(), cl->cipher_outkey, cl->cipher_outkey + EVP_bf_cfb()->key_len);
496 int metakey_h(conn_list_t *cl)
501 if(sscanf(cl->buffer, "%*d %as", &buffer) != 1)
503 syslog(LOG_ERR, _("Got bad METAKEY from %s (%s)"), cl->name, cl->hostname);
507 len = RSA_size(myself->rsa_key);
509 /* Check if the length of the meta key is all right */
511 if(strlen(buffer) != len*2)
513 syslog(LOG_ERR, _("Intruder: wrong meta key length from %s (%s)"), cl->name, cl->hostname);
518 /* Allocate buffers for the meta key */
520 if(!cl->cipher_inkey)
521 cl->cipher_inkey = xmalloc(len);
523 if(!cl->cipher_inctx)
524 cl->cipher_inctx = xmalloc(sizeof(*cl->cipher_inctx));
526 /* Convert the challenge from hexadecimal back to binary */
528 hex2bin(buffer,buffer,len);
530 /* Decrypt the meta key */
532 if(RSA_private_decrypt(len, buffer, cl->cipher_inkey, myself->rsa_key, RSA_NO_PADDING) != len) /* See challenge() */
534 syslog(LOG_ERR, _("Error during encryption of meta key for %s (%s)"), cl->name, cl->hostname);
539 if(debug_lvl >= DEBUG_SCARY_THINGS)
541 bin2hex(cl->cipher_inkey, buffer, len);
542 buffer[len*2] = '\0';
543 syslog(LOG_DEBUG, _("Received random meta key (unencrypted): %s"), buffer);
548 EVP_DecryptInit(cl->cipher_inctx, EVP_bf_cfb(), cl->cipher_inkey, cl->cipher_inkey + EVP_bf_cfb()->key_len);
551 if(cl->status.outgoing)
554 return send_metakey(cl);
557 int send_ack(conn_list_t *cl)
561 if(cl->status.outgoing)
562 cl->allow_request = ACK;
564 x = send_request(cl, "%d", ACK);
565 cl->status.encryptout = 1;
570 int ack_h(conn_list_t *cl)
572 conn_list_t *old, *p;
575 /* Okay, before we active the connection, we check if there is another entry
576 in the connection list with the same name. If so, it presumably is an
577 old connection that has timed out but we don't know it yet.
580 while((old = lookup_id(cl->name)))
582 if(debug_lvl >= DEBUG_CONNECTIONS)
583 syslog(LOG_NOTICE, _("Removing old entry for %s at %s in favour of new connection from %s"),
584 cl->name, old->hostname, cl->hostname);
586 terminate_connection(old);
589 /* Activate this connection */
591 cl->allow_request = ALL;
592 cl->status.active = 1;
593 cl->status.decryptin = 1;
595 cl->cipher_pkttype = EVP_bf_cfb();
596 cl->cipher_pktkeylength = cl->cipher_pkttype->key_len + cl->cipher_pkttype->iv_len;
598 if(debug_lvl >= DEBUG_CONNECTIONS)
599 syslog(LOG_NOTICE, _("Connection with %s (%s) activated"), cl->name, cl->hostname);
602 if(!cl->status.outgoing)
605 /* Send him our subnets */
607 for(s = myself->subnets; s; s = s->next)
608 send_add_subnet(cl, s);
610 /* And send him all the hosts and their subnets we know... */
612 for(p = conn_list; p; p = p->next)
613 if(p != cl && p->status.active)
615 /* Notify others of this connection */
618 send_add_host(p, cl);
620 /* Notify new connection of everything we know */
622 send_add_host(cl, p);
624 for(s = p->subnets; s; s = s->next)
625 send_add_subnet(cl, s);
631 /* Address and subnet information exchange */
633 int send_add_subnet(conn_list_t *cl, subnet_t *subnet)
638 x = send_request(cl, "%d %s %s", ADD_SUBNET,
639 subnet->owner->name, netstr = net2str(subnet));
645 int add_subnet_h(conn_list_t *cl)
649 conn_list_t *owner, *p;
652 if(sscanf(cl->buffer, "%*d %as %as", &name, &subnetstr) != 2)
654 syslog(LOG_ERR, _("Got bad ADD_SUBNET from %s (%s)"), cl->name, cl->hostname);
655 free(name); free(subnetstr);
659 /* Check if owner name is a valid */
663 syslog(LOG_ERR, _("Got bad ADD_SUBNET from %s (%s): invalid identity name"), cl->name, cl->hostname);
664 free(name); free(subnetstr);
668 /* Check if subnet string is valid */
670 if(!(subnet = str2net(subnetstr)))
672 syslog(LOG_ERR, _("Got bad ADD_SUBNET from %s (%s): invalid subnet string"), cl->name, cl->hostname);
673 free(name); free(subnetstr);
679 /* Check if somebody tries to add a subnet of ourself */
681 if(!strcmp(name, myself->name))
683 syslog(LOG_ERR, _("Warning: got ADD_SUBNET from %s (%s) for ourself, restarting"),
684 cl->name, cl->hostname);
690 /* Check if the owner of the new subnet is in the connection list */
692 if(!(owner = lookup_id(name)))
694 syslog(LOG_ERR, _("Got ADD_SUBNET for %s from %s (%s) which is not in our connection list"),
695 name, cl->name, cl->hostname);
700 /* If everything is correct, add the subnet to the list of the owner */
702 subnet_add(owner, subnet);
706 for(p = conn_list; p; p = p->next)
707 if(p->status.meta && p->status.active && p!= cl)
708 send_add_subnet(p, subnet);
713 int send_del_subnet(conn_list_t *cl, subnet_t *subnet)
718 netstr = net2str(subnet);
719 x = send_request(cl, "%d %s %s", DEL_SUBNET, subnet->owner->name, netstr);
725 int del_subnet_h(conn_list_t *cl)
729 conn_list_t *owner, *p;
732 if(sscanf(cl->buffer, "%*d %as %as", &name, &subnetstr) != 3)
734 syslog(LOG_ERR, _("Got bad DEL_SUBNET from %s (%s)"), cl->name, cl->hostname);
735 free(name); free(subnetstr);
739 /* Check if owner name is a valid */
743 syslog(LOG_ERR, _("Got bad DEL_SUBNET from %s (%s): invalid identity name"), cl->name, cl->hostname);
744 free(name); free(subnetstr);
748 /* Check if subnet string is valid */
750 if(!(subnet = str2net(subnetstr)))
752 syslog(LOG_ERR, _("Got bad DEL_SUBNET from %s (%s): invalid subnet string"), cl->name, cl->hostname);
753 free(name); free(subnetstr);
759 /* Check if somebody tries to add a subnet of ourself */
761 if(!strcmp(name, myself->name))
763 syslog(LOG_ERR, _("Warning: got DEL_SUBNET from %s (%s) for ourself, restarting"),
764 cl->name, cl->hostname);
770 /* Check if the owner of the new subnet is in the connection list */
772 if(!(owner = lookup_id(name)))
774 syslog(LOG_ERR, _("Got DEL_SUBNET for %s from %s (%s) which is not in our connection list"),
775 name, cl->name, cl->hostname);
780 /* If everything is correct, delete the subnet from the list of the owner */
786 for(p = conn_list; p; p = p->next)
787 if(p->status.meta && p->status.active && p!= cl)
788 send_del_subnet(p, subnet);
793 /* New and closed connections notification */
795 int send_add_host(conn_list_t *cl, conn_list_t *other)
798 return send_request(cl, "%d %s %lx:%d %lx", ADD_HOST,
799 other->name, other->address, other->port, other->options);
802 int add_host_h(conn_list_t *cl)
804 conn_list_t *old, *new;
808 new = new_conn_list();
810 if(sscanf(cl->buffer, "%*d %as %lx:%d %lx", &new->name, &new->address, &new->port, &new->options) != 4)
812 syslog(LOG_ERR, _("Got bad ADD_HOST from %s (%s)"), cl->name, cl->hostname);
816 /* Check if identity is a valid name */
818 if(check_id(new->name))
820 syslog(LOG_ERR, _("Got bad ADD_HOST from %s (%s): invalid identity name"), cl->name, cl->hostname);
825 /* Check if somebody tries to add ourself */
827 if(!strcmp(new->name, myself->name))
829 syslog(LOG_ERR, _("Warning: got ADD_HOST from %s (%s) for ourself, restarting"), cl->name, cl->hostname);
835 /* Fill in more of the new conn_list structure */
837 new->hostname = hostlookup(htonl(new->address));
839 /* Check if the new host already exists in the connnection list */
841 if((old = lookup_id(new->name)))
843 if((new->address == old->address) && (new->port == old->port))
845 if(debug_lvl >= DEBUG_CONNECTIONS)
846 syslog(LOG_NOTICE, _("Got duplicate ADD_HOST for %s (%s) from %s (%s)"),
847 old->name, old->hostname, new->name, new->hostname);
853 if(debug_lvl >= DEBUG_CONNECTIONS)
854 syslog(LOG_NOTICE, _("Removing old entry for %s (%s) in favour of new connection"),
855 old->name, old->hostname);
857 terminate_connection(old);
861 /* Hook it up into the conn_list */
865 /* Tell the rest about the new host */
867 for(p = conn_list; p; p = p->next)
868 if(p->status.meta && p->status.active && p!=cl)
869 send_add_host(p, new);
871 /* Fill in rest of conn_list structure */
874 new->status.active = 1;
880 int send_del_host(conn_list_t *cl, conn_list_t *other)
883 return send_request(cl, "%d %s %lx:%d %lx", DEL_HOST,
884 other->name, other->address, other->port, other->options);
887 int del_host_h(conn_list_t *cl)
893 conn_list_t *old, *p;
895 if(sscanf(cl->buffer, "%*d %as %lx:%d %lx", &name, &address, &port, &options) != 4)
897 syslog(LOG_ERR, _("Got bad DEL_HOST from %s (%s)"),
898 cl->name, cl->hostname);
902 /* Check if identity is a valid name */
906 syslog(LOG_ERR, _("Got bad DEL_HOST from %s (%s): invalid identity name"), cl->name, cl->hostname);
911 /* Check if somebody tries to delete ourself */
913 if(!strcmp(name, myself->name))
915 syslog(LOG_ERR, _("Warning: got DEL_HOST from %s (%s) for ourself, restarting"),
916 cl->name, cl->hostname);
922 /* Check if the new host already exists in the connnection list */
924 if(!(old = lookup_id(name)))
926 syslog(LOG_ERR, _("Got DEL_HOST from %s (%s) for %s which is not in our connection list"),
927 name, cl->name, cl->hostname);
932 /* Check if the rest matches */
934 if(address!=old->address || port!=old->port || options!=old->options || cl!=old->nexthop)
936 syslog(LOG_WARNING, _("Got DEL_HOST from %s (%s) for %s which doesn't match"), cl->name, cl->hostname, old->name);
940 /* Ok, since EVERYTHING seems to check out all right, delete it */
942 old->status.active = 0;
943 terminate_connection(old);
945 /* Tell the rest about the new host */
947 for(p = conn_list; p; p = p->next)
948 if(p->status.meta && p->status.active && p!=cl)
949 send_del_host(p, old);
954 /* Status and error notification routines */
956 int send_status(conn_list_t *cl, int statusno, char *statusstring)
960 statusstring = status_text[statusno];
962 return send_request(cl, "%d %d %s", STATUS, statusno, statusstring);
965 int status_h(conn_list_t *cl)
970 if(sscanf(cl->buffer, "%*d %d %as", &statusno, &statusstring) != 2)
972 syslog(LOG_ERR, _("Got bad STATUS from %s (%s)"),
973 cl->name, cl->hostname);
977 if(debug_lvl >= DEBUG_STATUS)
979 syslog(LOG_NOTICE, _("Status message from %s (%s): %s: %s"),
980 cl->name, cl->hostname, status_text[statusno], statusstring);
988 int send_error(conn_list_t *cl, int errno, char *errstring)
992 errstring = strerror(errno);
993 return send_request(cl, "%d %d %s", ERROR, errno, errstring);
996 int error_h(conn_list_t *cl)
1001 if(sscanf(cl->buffer, "%*d %d %as", &errno, &errorstring) != 2)
1003 syslog(LOG_ERR, _("Got bad ERROR from %s (%s)"),
1004 cl->name, cl->hostname);
1008 if(debug_lvl >= DEBUG_ERROR)
1010 syslog(LOG_NOTICE, _("Error message from %s (%s): %s: %s"),
1011 cl->name, cl->hostname, strerror(errno), errorstring);
1015 terminate_connection(cl);
1020 int send_termreq(conn_list_t *cl)
1023 return send_request(cl, "%d", TERMREQ);
1026 int termreq_h(conn_list_t *cl)
1029 terminate_connection(cl);
1034 /* Keepalive routines - FIXME: needs a closer look */
1036 int send_ping(conn_list_t *cl)
1038 cl->status.pinged = 1;
1040 return send_request(cl, "%d", PING);
1043 int ping_h(conn_list_t *cl)
1046 return send_pong(cl);
1049 int send_pong(conn_list_t *cl)
1052 return send_request(cl, "%d", PONG);
1055 int pong_h(conn_list_t *cl)
1058 cl->status.got_pong = 1;
1065 int send_key_changed(conn_list_t *from, conn_list_t *cl)
1069 for(p = conn_list; p != NULL; p = p->next)
1071 if(p!=cl && p->status.meta && p->status.active)
1072 send_request(p, "%d %s", KEY_CHANGED,
1079 int key_changed_h(conn_list_t *cl)
1084 if(sscanf(cl->buffer, "%*d %as", &from_id) != 1)
1086 syslog(LOG_ERR, _("Got bad KEY_CHANGED from %s (%s)"),
1087 cl->name, cl->hostname);
1091 if(!(from = lookup_id(from_id)))
1093 syslog(LOG_ERR, _("Got KEY_CHANGED from %s (%s) origin %s which does not exist in our connection list"),
1094 cl->name, cl->hostname, from_id);
1101 from->status.validkey = 0;
1102 from->status.waitingforkey = 0;
1104 send_key_changed(from, cl);
1109 int send_req_key(conn_list_t *from, conn_list_t *to)
1112 return send_request(to->nexthop, "%d %s %s", REQ_KEY,
1113 from->name, to->name);
1116 int req_key_h(conn_list_t *cl)
1118 char *from_id, *to_id;
1119 conn_list_t *from, *to;
1122 if(sscanf(cl->buffer, "%*d %as %as", &from_id, &to_id) != 2)
1124 syslog(LOG_ERR, _("Got bad REQ_KEY from %s (%s)"),
1125 cl->name, cl->hostname);
1129 if(!(from = lookup_id(from_id)))
1131 syslog(LOG_ERR, _("Got REQ_KEY from %s (%s) origin %s which does not exist in our connection list"),
1132 cl->name, cl->hostname, from_id);
1133 free(from_id); free(to_id);
1137 /* Check if this key request is for us */
1139 if(!strcmp(to_id, myself->name))
1141 bin2hex(myself->cipher_pktkey, pktkey, myself->cipher_pktkeylength);
1142 pktkey[myself->cipher_pktkeylength*2] = '\0';
1143 send_ans_key(myself, from, pktkey);
1147 if(!(to = lookup_id(to_id)))
1149 syslog(LOG_ERR, _("Got REQ_KEY from %s (%s) destination %s which does not exist in our connection list"),
1150 cl->name, cl->hostname, to_id);
1151 free(from_id); free(to_id);
1155 if(to->status.validkey) /* Proxy keys */
1157 bin2hex(to->cipher_pktkey, pktkey, to->cipher_pktkeylength);
1158 pktkey[to->cipher_pktkeylength*2] = '\0';
1159 send_ans_key(to, from, pktkey);
1162 send_req_key(from, to);
1165 free(from_id); free(to_id);
1170 int send_ans_key(conn_list_t *from, conn_list_t *to, char *pktkey)
1173 return send_request(to->nexthop, "%d %s %s %s", ANS_KEY,
1174 from->name, to->name, pktkey);
1177 int ans_key_h(conn_list_t *cl)
1179 char *from_id, *to_id, *pktkey;
1181 conn_list_t *from, *to;
1183 if(sscanf(cl->buffer, "%*d %as %as %as", &from_id, &to_id, &pktkey) != 3)
1185 syslog(LOG_ERR, _("Got bad ANS_KEY from %s (%s)"),
1186 cl->name, cl->hostname);
1190 if(!(from = lookup_id(from_id)))
1192 syslog(LOG_ERR, _("Got ANS_KEY from %s (%s) origin %s which does not exist in our connection list"),
1193 cl->name, cl->hostname, from_id);
1194 free(from_id); free(to_id); free(pktkey);
1198 /* Update origin's packet key */
1200 keylength = strlen(pktkey);
1202 if(keylength != from->cipher_pktkeylength*2)
1204 syslog(LOG_ERR, _("Got bad ANS_KEY from %s (%s) origin %s: invalid key length"),
1205 cl->name, cl->hostname, from->name);
1206 free(from_id); free(to_id); free(pktkey);
1210 if(from->cipher_pktkey)
1211 free(from->cipher_pktkey);
1214 hex2bin(pktkey, pktkey, keylength);
1215 pktkey[keylength] = '\0';
1216 from->cipher_pktkey = pktkey;
1218 from->status.validkey = 1;
1219 from->status.waitingforkey = 0;
1221 if(strcmp(to_id, myself->name))
1223 if(!(to = lookup_id(to_id)))
1225 syslog(LOG_ERR, _("Got ANS_KEY from %s (%s) destination %s which does not exist in our connection list"),
1226 cl->name, cl->hostname, to_id);
1227 free(from_id); free(to_id);
1230 send_ans_key(from, to, pktkey);
1233 free(from_id); free(to_id);
1238 /* Jumptable for the request handlers */
1240 int (*request_handlers[])(conn_list_t*) = {
1241 id_h, challenge_h, chal_reply_h, metakey_h, ack_h,
1242 status_h, error_h, termreq_h,
1244 add_host_h, del_host_h,
1245 add_subnet_h, del_subnet_h,
1246 key_changed_h, req_key_h, ans_key_h,
1251 char (*request_name[]) = {
1252 "ID", "CHALLENGE", "CHAL_REPLY", "METAKEY", "ACK",
1253 "STATUS", "ERROR", "TERMREQ",
1255 "ADD_HOST", "DEL_HOST",
1256 "ADD_SUBNET", "DEL_SUBNET",
1257 "KEY_CHANGED", "REQ_KEY", "ANS_KEY",
1260 /* Status strings */
1262 char (*status_text[]) = {
1268 char (*error_text[]) = {